pyopenssl-list — General discussion list for users and developers of pyOpenSSL

[pyOpenSSL] PATCH: Handle long serial numbers in X509 get_serial_number

[Leigh D. <le...@ec...>]

Hi all,

I've recently been looking at pyOpenSSL but I noticed that it didn't 
properly handle the serial numbers in the Verisign certificates that I'm 
using. The serial numbers are long - too big to fit in a 32-bit int, so 
OpenSSL returns -1 instead, which is passed through by pyOpenSSL.

This small patch handles these long serial numbers by converting them to 
strings, which are then converted to PyLong objects using the Python/C API.

Thanks
Leigh

[pyOpenSSL] OpenSSL.SSL.ZeroReturnError

[Ajay <abr...@ma...>]

hi!

i have a client and server that communicate over an SSL connection. the
client connects to the server and sends some data and then closes. For
some reason, on the server side, every time i try to read data, i ger a
ZeroReturnError.

my client code is
s =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
conn =3D SSL.Connection(ctx, s)
conn.connect((host, port))
conn.send(result)
conn.shutdown()
conn.close()

the server is

addr =3D (SERVICE_HOST, SERVICE_PORT)
globals()['serverconn'] =3D Connection(context, socket.socket(socket.AF_I=
NET,
socket.SOCK_STREAM))
globals()['serverconn'].bind(addr)
print "server started"
globals()['serverconn'].listen(5)
while 1:
	(cli, address) =3D globals()['serverconn'].accept()
	print 'Connection from %s' % (addr,)
	#try:
	str =3D cli.recv(1024)
	data=3D""
	while len(str) !=3D 0:
		data +=3D str
		str =3D cli.recv(1024)
	print "received " #, data

the error comes at "str =3D cli.recv(1024)"
i get to the 'the connection from...' print statement, and then the error
comes up.

What am i doing wrong? And how can i get rid of the error?
the same code worked fine before i added the SSL part, so i doubt there i=
s
anything fundamentally wrong with the code.

thanks

cheers

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] certificate verification

[Ajay <abr...@ma...>]

Quoting Martin Sj=F6gren <msj...@gm...>:

> On Sat,  2 Oct 2004 14:54:57 +1000, Ajay <abr...@ma...>
> wrote:
> > hi!
> >
> > i added a callback for set_verify.
> > ctx.set_verify(VERIFY_NONE, verify)
> >
> > in verify, i put a print statement and it gets called twice - once fo=
r
> > CA.cert and once for server.cert. Shouldn't it get called only once,
> for
> > server.cert
>
> No, the callback gets called once for every cert in the cert chain,
> starting with the root and ending with the server's cert. One of the
> arguments is the depth, I don't recall off hand.
>
> > also how would you verify the server certificate? what would you add
> to
> > verify()
>
> Well, for starters I'd use SSL.VERIFY_PEER rather than VERIFY_NONE ;)
> You should probably read the man page for SSL_CTX_set_verify_callback,
> this is basic openssl stuff.
>

SSL_CTX_set_verify_callback says you can pass a NULL for the callback in
which case the OpenSSL built in verify is used to perform the verificatio=
n
(which should be sufficient for most cases).

So how do i get it to use the built in 'verify'.
ctx.set_verify(VERIFY_PEER, None) is an error

all i really want to do is verify that the certificate presented by the
server is authentic, which should be handled by the built in function.

cheers



>
> /Martin
>


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] certificate verification

[<msj...@gm...>]

On Sat,  2 Oct 2004 14:54:57 +1000, Ajay <abr...@ma...> wrote:
> hi!
> 
> i added a callback for set_verify.
> ctx.set_verify(VERIFY_NONE, verify)
> 
> in verify, i put a print statement and it gets called twice - once for
> CA.cert and once for server.cert. Shouldn't it get called only once, for
> server.cert

No, the callback gets called once for every cert in the cert chain,
starting with the root and ending with the server's cert. One of the
arguments is the depth, I don't recall off hand.
 
> also how would you verify the server certificate? what would you add to
> verify()

Well, for starters I'd use SSL.VERIFY_PEER rather than VERIFY_NONE ;)
You should probably read the man page for SSL_CTX_set_verify_callback,
this is basic openssl stuff.


/Martin

[pyOpenSSL] certificate verification

[Ajay <abr...@ma...>]

hi!

i added a callback for set_verify.
ctx.set_verify(VERIFY_NONE, verify)

in verify, i put a print statement and it gets called twice - once for
CA.cert and once for server.cert. Shouldn't it get called only once, for
server.cert

also how would you verify the server certificate? what would you add to
verify()

thanks

cheers





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] build for WinCE

[Ajay <abr...@ma...>]

hi!

i have built PyOpenSSL for WinCE.
I didn't use the setup.py to build it, used Embedded Visual C++ 3.0.
If you'd like i can submit the binaries along with a quick HOWTO for anyo=
ne
who wants to build from source.

let me know if you want that.

cheers




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] rand and seeding the PRNG

[Ajay <abr...@ma...>]

hi!

i cant do a handshake using OpenSSL on a pocket pc. it throws up an error
saying PRNG not seeded(and it doesnt seed from the .rnd file since there
is no concept of a C:\ on the pocket pc and no environment variables
either)
If i get PyOpenSSL working on the PDA would it be possible for me to use
the rand interface to seed the PRNG and the use that to do the SSL
handshake.

Will that work?

i'm really short on time and so dont want to try something that may not
work.

thanks

cheers





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] PyopenSSL examples

[dave <da...@im...>]

SPIKE Proxy uses it - you can download it from www.immunitysec.com .

-dave


Ajay wrote:

>hi!
>
>any chances of having examples of using PyOpenSSL?
>
>cheers
>
>----------------------------------------------------------------
>This message was sent using IMP, the Internet Messaging Program.
>
>
>-------------------------------------------------------
>This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
>Use IT products in your business? Tell us what you think of them. Give us
>Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
>http://productguide.itmanagersjournal.com/guidepromo.tmpl
>_______________________________________________
>pyopenssl-list mailing list
>pyo...@li...
>https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>  
>

[pyOpenSSL] building and an error

[Ajay <abr...@ma...>]

hi!

i have built PyOpenSSL for WinCE using eVC++, trouble is import doesn't
work.
what i have done is, instead of hacking around distutils, i have simply
added all source and header files to a evc project and built them
(building all crypto to crypto.pyd and so on). the trouble is import
crypto throws an error saying initcrypto not defined.
i have checked the source and initcrypto is defined...i build PyOpenSSL i=
n
the same way on a PC using VC++ 6.0 and that works okay so i dont know
where the error is coming from.

i am using the client.py and server.py in 'examples/simple' (i found the
examples :)) and would like no authentication at all. just an encrypted
exchange.
But when do
ctx.set_verify(VERIFY_NONE, verify_cb)
on both the client and server end, the server does not call verify_cb (as
expected) but the client makes the call and whats more it calls twice ( i
have a print statement in there).
how can i have no server authentication and where is the extra call
(shouldn't it be called only once)

thanks

cheers




----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] error creating SSL connection

[Ajay <abr...@ma...>]

hi!

i am trying to setup a simple SSL connection without any authentication
whatsoever.
the scripts for client and server are below.
running client gives the error

Traceback (most recent call last):
  File "ssl_client.py", line 28, in ?
    run_client()
  File "ssl_client.py", line 20, in run_client
    conn.send("ajay rules the world")
OpenSSL.SSL.Error: [('SSL routines', 'SSL3_READ_BYTES', 'sslv3 alert
handshake f
ailure'), ('SSL routines', 'SSL3_WRITE_BYTES', 'ssl handshake failure')]

running server gives
Traceback (most recent call last):
  File "ssl_server.py", line 35, in ?
    run_server()
  File "ssl_server.py", line 29, in run_server
    str =3D sock.recv(1024)
OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_CLIENT_HELLO', 'no shared
cipher
)]

and i cant figure out where the error is

thanks

#ssl_server.py

import sys
from OpenSSL.SSL import *
import socket
import signal

SERVICE_PORT=3D6790
SERVICE_HOST=3D"blade1"

def handleintr(sig, frame):
	sys.exit(0)
signal.signal(signal.SIGINT, handleintr)

def run_server():
	context =3D Context(SSLv3_METHOD)
	context.set_cipher_list("SSLv3")
	context.set_verify(VERIFY_NONE, authenticateClient)
	serversocket =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	addr =3D (SERVICE_HOST, SERVICE_PORT)
	conn =3D Connection(context, serversocket)
	conn.set_accept_state()
	conn.bind(addr)
	conn.listen(5)
	print "listening"
	while 1:
		print "waiting to receive"
		(sock, address) =3D conn.accept()
		str =3D sock.recv(1024)
		print str

def authenticateClient(conn, x509, a, b, c):
	return 1

run_server()

#ssl_client.py

import sys
from OpenSSL.SSL import *
import socket

SERVICE_PORT=3D6790
SERVICE_HOST=3D"blade1"

def run_client():
	context =3D Context(SSLv3_METHOD)
	context.set_cipher_list("SSLv3")
	context.set_verify(VERIFY_NONE, authenticateServer)
	sock =3D socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	addr =3D (SERVICE_HOST, SERVICE_PORT)
	conn =3D Connection(context, sock)
	conn.set_connect_state()
	conn.connect(addr)
	print "connected"
	conn.send("ajay rules the world")
	conn.close()

def authenticateServer(conn, x509, a, b, c):
	print a,b,c
	print "called callback"
	return 1

run_client()



----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] PyopenSSL examples

[Ajay <abr...@ma...>]

hi!

any chances of having examples of using PyOpenSSL?

cheers

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] importing pyopenssl

[Ajay <abr...@ma...>]

>
> --
> Ajay Brar,
> CS Honours 2004
> Smart Internet Technology Research Group
>
>
> Quoting Martin Sj=F6gren <msj...@gm...>:
>
> > On Tue, 28 Sep 2004 21:42:48 +1000, Ajay <abr...@ma...>
> > wrote:
> > > hi!
> > >
> > > i correctly installed PyOpenSSL. however when i try
> > > >>> import OpenSSL
> > > Traceback (most recent call last):
> > >   File "<stdin>", line 1, in ?
> > >   File "/local/usr/lib/python2.3/site-packages/OpenSSL/__init__.py"=
,
> > line
> > > 11, in
> > >  ?
> > >     import rand, crypto, SSL, tsafe
> > > ImportError: No module named rand
> > >
> > > how do i go about using the modules?
> >
> > Well, if you get this kind of import error I highly doubt that you've
> > got a fully working build. When you build pyopenssl (python setup.py
> > build) you should end up with the following files in
> > build/lib.something/OpenSSL: __init__.py, version.py, tsafe.py,
> > rand.so, crypto.so, SSL.so.
> >
> > "import OpenSSL" or "from OpenSSL import crypto, SSL" or what have yo=
u
> > *is* the right way to import the modules. If that doesn't work,
> > something's wrong.
> >

import now works. it was a faulty build.
but now from OpenSSL import SSL doesn't work. it throws the error

>>> from OpenSSL import SSL
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
ImportError: ld.so.1: python: fatal: relocation error: file OpenSSL/SSL.s=
o:
symbol SSL_renegotiate_pending: referenced symbol not found

while

>>> import OpenSSL
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/usr/hons2004/abrar1/lib/python/OpenSSL/__init__.py", line 11, in=
 ?
    import rand, crypto, SSL, tsafe
ImportError: ld.so.1: python: fatal: relocation error: file
OpenSSL/crypto.so: symbol OPENSSL_add_all_algorithms_noconf: referenced
symbol not found


any ideas what may be wrong here?

thanks

cheers




>
>
>
> >
> > /Martin
> >
>
>
> ----------------------------------------------------------------
> This message was sent using IMP, the Internet Messaging Program.
>
>
> -------------------------------------------------------
> This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
> Project Admins to receive an Apple iPod Mini FREE for your judgement on
> who ports your project to Linux PPC the best. Sponsored by IBM.
> Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
> _______________________________________________
> pyopenssl-list mailing list
> pyo...@li...
> https://lists.sourceforge.net/lists/listinfo/pyopenssl-list
>
>


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] importing pyopenssl

[Ajay <abr...@ma...>]

--
Ajay Brar,
CS Honours 2004
Smart Internet Technology Research Group


Quoting Martin Sj=F6gren <msj...@gm...>:

> On Tue, 28 Sep 2004 21:42:48 +1000, Ajay <abr...@ma...>
> wrote:
> > hi!
> >
> > i correctly installed PyOpenSSL. however when i try
> > >>> import OpenSSL
> > Traceback (most recent call last):
> >   File "<stdin>", line 1, in ?
> >   File "/local/usr/lib/python2.3/site-packages/OpenSSL/__init__.py",
> line
> > 11, in
> >  ?
> >     import rand, crypto, SSL, tsafe
> > ImportError: No module named rand
> >
> > how do i go about using the modules?
>
> Well, if you get this kind of import error I highly doubt that you've
> got a fully working build. When you build pyopenssl (python setup.py
> build) you should end up with the following files in
> build/lib.something/OpenSSL: __init__.py, version.py, tsafe.py,
> rand.so, crypto.so, SSL.so.
>
> "import OpenSSL" or "from OpenSSL import crypto, SSL" or what have you
> *is* the right way to import the modules. If that doesn't work,
> something's wrong.
>
i thought you could only import Python .py or .pyd files.
i am quite sure my build went okay. those are the files that i have. the
system admin on my server has already built PyOpenSSL. i tried import the=
n
but that threw the same error.
So i built again to my home directory, added that to the path and tried
import from there. that gave the same error.
buiild and install didn't throw any errors or warnings at all.
i am running this on a solaris.



>
> /Martin
>


----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] importing pyopenssl

[<msj...@gm...>]

On Tue, 28 Sep 2004 21:42:48 +1000, Ajay <abr...@ma...> wrote:
> hi!
> 
> i correctly installed PyOpenSSL. however when i try
> >>> import OpenSSL
> Traceback (most recent call last):
>   File "<stdin>", line 1, in ?
>   File "/local/usr/lib/python2.3/site-packages/OpenSSL/__init__.py", line
> 11, in
>  ?
>     import rand, crypto, SSL, tsafe
> ImportError: No module named rand
> 
> how do i go about using the modules?

Well, if you get this kind of import error I highly doubt that you've
got a fully working build. When you build pyopenssl (python setup.py
build) you should end up with the following files in
build/lib.something/OpenSSL: __init__.py, version.py, tsafe.py,
rand.so, crypto.so, SSL.so.

"import OpenSSL" or "from OpenSSL import crypto, SSL" or what have you
*is* the right way to import the modules. If that doesn't work,
something's wrong.


/Martin

[pyOpenSSL] importing pyopenssl

[Ajay <abr...@ma...>]

hi!

i correctly installed PyOpenSSL. however when i try
>>> import OpenSSL
Traceback (most recent call last):
  File "<stdin>", line 1, in ?
  File "/local/usr/lib/python2.3/site-packages/OpenSSL/__init__.py", line
11, in
 ?
    import rand, crypto, SSL, tsafe
ImportError: No module named rand

how do i go about using the modules?

thanks

cheers





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] building for winCE

[Ajay <abr...@ma...>]

hi!

i built PyOpenSSL for WinCE, but when i was getting an error on import.
thinking that perhaps the way i went about doing it wasn't correct (i
didn't use setup.py since i dont have enough knowhow about hacking it to
make it work on WinCE, i simply combined all the C code and compiled it
into a DLL).

I then tried writing a simple C file that makes a few calls to the OpenSS=
L
API. the code is below.

this builds fine, but again when i do
>>>import testssl
i get
ImportError: DLL load failed. The specified module could not be found.

i am hoping people on this list, hopefully the developers of PyOpenSSL (w=
ho
have written code like the one below), could shed some light on what it i=
s
thats wrong with my piece of code.

thanks




#include <Python.h>
#include "openssl/bio.h"
#include "openssl/ssl.h"
#include "openssl/err.h"

static PyObject * start(PyObject *self, PyObject *args)
{
        int x;
        BIO * bio;
        char buf[1024];
        int len =3D 512;
        SSL_load_error_strings();
        ERR_load_BIO_strings();
        OpenSSL_add_all_algorithms();
        bio =3D BIO_new_connect("www.ibm.com:80");
        if(bio=3D=3DNULL)
        {
                //handle error
                x =3D -5;
        }
        if(BIO_do_connect(bio) <=3D 0)
        {
                //handle failed connection
                x =3D -4;
        }
        x =3D BIO_read(bio, buf, len);
        if(x =3D=3D 0)
        {
                //handle closed connection
                x =3D -3;
        }
        else if(x<0)
        {
                if(! BIO_should_retry(bio))
                {
                        //handle failed read
                        x =3D -2;
                }
                //do something to handle the retry
        }
        return Py_BuildValue("i", x);
}

static PyMethodDef testSSLMethods[] =3D {
        {"start", start, METH_VARARGS, "start and test SSL."},
        {NULL, NULL, 0, NULL}
};

PyMODINIT_FUNC
inittestSSL(void)
{
        (void) Py_InitModule("testSSL", testSSLMethods);
}





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Re: [pyOpenSSL] building PyOpenSSL

[<msj...@gm...>]

On Fri, 24 Sep 2004 15:24:47 +1000, Ajay <abr...@ma...> wrote:
> i am wondering if anyone has used pyopenssl on a pocket pc. I have built
> openSSL for pocket pc (a few dll's) and it passed all the tests.
> To build pyopenssl, do i need openssl source or can i just use the dll's.
> thanks

Well, you need the OpenSSL header files, of course, but other than
that, just the dlls.

If you need to hack setup.py to get it to compile, please send me a
patch and include the values of sys.platform and os.name so I know
what to test for.


/Martin

[pyOpenSSL] building PyOpenSSL

[Ajay <abr...@ma...>]

hi!

i am wondering if anyone has used pyopenssl on a pocket pc. I have built
openSSL for pocket pc (a few dll's) and it passed all the tests.
To build pyopenssl, do i need openssl source or can i just use the dll's.
thanks

cheers





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

[pyOpenSSL] Error using pyOpenSSL with IE and https

[Ola N. <ol...@o-...>]

Hello

I am building a threaded ssl webserver, using pyOpenSSL. It works well with
Opera, but I encounter big problems
with IE and some minor once with Mozilla. When I connect to my server with
IE and tries to read from the connection 
an exeption are raised:

SysCallError: (-1, 'Unexpected EOF')

In the line whom I call "connection.recv(1024)"

In mozilla reading from the socket works fine, but I encounter problems
while trying to POST to the server,
Mozilla displays the errormassage "This document contain no data", the
headers are sent but the body of the request are empty, and the same form
works well when I post to the same server with Opera.

I hope someone out there have some solutions to my problems.
I am currently running the server on a Windows XP computer and I installed
pyOpenSSL using the windows installer supplied at the Twisted website.

Regards
Ola Natvig

[pyOpenSSL] [ANN] pyOpenSSL 0.6 released

[<msj...@gm...>]

After a long hiatus during which I've somehow managed to write a
master's thesis, I'm pleased to announce the release of pyOpenSSL 0.6.

There are bug fixes, the most important being support for the cyclic
GC, which got rid of a few nasty memory leak bugs.

There is added functionality to some types, there is brand new support
for the Netscape SPKI extensions and much more. Much of this comes
from contributions from the user base and I'm really happy about that.

If anybody would like to contribute Windows binaries, I'd be happy to
put them on the sourceforge project page, I have no possibility to
compile them myself.

Grab the release from
http://sourceforge.net/project/showfiles.php?group_id=3D31249&package_id=3D=
23298&release_id=3D260375


/Martin Sj=F6gren

[pyOpenSSL] 0.6 RC 1

[<msj...@gm...>]

Hello list.

I'm trying to get a version 0.6 released... well, pretty soon. Here's
the current state:

http://pyopenssl.sf.net/pyOpenSSL-0.6rc1.tar.gz

The more people who could give this a test and tell me what they
think, the happier I will be. And we all want me to be happy, right?
...
Well, at least I do... :)


Cheers,
Martin

Re: [pyOpenSSL] notBefore and notAfter (was Re: pyOpenSSL certificate information - how?)

[Mihai I. <mi...@re...>]

On Sun, Aug 08, 2004 at 02:02:33PM +0200, Martin Sj=F6gren wrote:
> On Fri, 6 Aug 2004 10:54:37 -0400, Mihai Ibanescu <mi...@re...> wro=
te:
> > On a slightly related note.
> > I cannot seem to be able to retrieve notBefore and notAfter from an X=
509 cert.
> > I suppose that would be a good thing to add, wouldn't it?
> > (I found how to set them, but not how to retrieve them).
>=20
> Well, ASN1_TIME in openssl is something of a mess. There's no good way
> to turn it into e.g. a time_t that could make sense in a python
> program. From what I understand of the code, you can basically do the
> following with an ASN1_TIME:
> * print it (ASN1_TIME_print / ASN1_UTCTIME_print)
> * set/adjust it (ASN1_TIME_set / X509_time_adj / X509_gmtime_adj / ...)
> * compare it (ASN1_UTCTIME_cmp_time_t)

That's what I figured when I tried to add them myself.

From <openssl/asn1.h>:

int ASN1_UTCTIME_check(ASN1_UTCTIME *a);
ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s,time_t t);
int ASN1_UTCTIME_set_string(ASN1_UTCTIME *s, char *str);
int ASN1_UTCTIME_cmp_time_t(const ASN1_UTCTIME *s, time_t t);
#if 0
time_t ASN1_UTCTIME_get(const ASN1_UTCTIME *s);
#endif


>=20
> The X509.has_expired method compares the notAfter value to "now".
>=20
> I'm not sure what makes sense to do here. I suppose we could add some
> sort of print_notBefore/print_notAfter methods to X509. Another idea
> would be to add a wrapper type for ASN1_TIME (crypto.ASN1Time?
> asn1.Time?) that could have a __str__ for the printing, and some
> comparison methods...
>=20
> I'm loathe to do anything dramatic though, since I'm trying to get a
> new version out the door before Debian sarge is released. ;-)
>=20
> Ideas and suggestions are most welcome.

Well, I had a quick look at what m2crypto does, and found out there is a
get_not_before and get_not_after. But they return strings, and I guess yo=
u are
left to parse the strings yourself in python. I believe the returned time=
s are
always GMT so it may not be that complicated.

I guess an ASN1_TIME type would make sense. Have its __str__ method use
openssl's ASN1_TIME_print, and have a to_epoch() method that would use
python's time conversion functions. Probably a warning in the documentati=
on
that this method is not openssl-"pure".

Misa

[pyOpenSSL] notBefore and notAfter (was Re: pyOpenSSL certificate information - how?)

[<msj...@gm...>]

On Fri, 6 Aug 2004 10:54:37 -0400, Mihai Ibanescu <mi...@re...> wrote:
> On a slightly related note.
> I cannot seem to be able to retrieve notBefore and notAfter from an X509 cert.
> I suppose that would be a good thing to add, wouldn't it?
> (I found how to set them, but not how to retrieve them).

Well, ASN1_TIME in openssl is something of a mess. There's no good way
to turn it into e.g. a time_t that could make sense in a python
program. From what I understand of the code, you can basically do the
following with an ASN1_TIME:
* print it (ASN1_TIME_print / ASN1_UTCTIME_print)
* set/adjust it (ASN1_TIME_set / X509_time_adj / X509_gmtime_adj / ...)
* compare it (ASN1_UTCTIME_cmp_time_t)

The X509.has_expired method compares the notAfter value to "now".

I'm not sure what makes sense to do here. I suppose we could add some
sort of print_notBefore/print_notAfter methods to X509. Another idea
would be to add a wrapper type for ASN1_TIME (crypto.ASN1Time?
asn1.Time?) that could have a __str__ for the printing, and some
comparison methods...

I'm loathe to do anything dramatic though, since I'm trying to get a
new version out the door before Debian sarge is released. ;-)

Ideas and suggestions are most welcome.


/Martin

Re: [pyOpenSSL] pyOpenSSL certificate information - how?

[Mihai I. <mi...@re...>]

On a slightly related note.
I cannot seem to be able to retrieve notBefore and notAfter from an X509 cert.
I suppose that would be a good thing to add, wouldn't it?
(I found how to set them, but not how to retrieve them).

Misa

Re: [pyOpenSSL] pyOpenSSL certificate information - how?

[<msj...@gm...>]

On Mon, 19 Jul 2004 19:13:47 +0200, Jos Vos <jo...@xo...> wrote:
> > What this tells you is that the only field of the X509Name that
> > actually has a value is the CN field, or "common name".
> 
> This actually works, thanks, but "common_name" or any of the other
> listed members (in the docs section 3.1.2) does not work, also
> not if the related fields exist (tested with another certificate).
> 
> So, is the documentation here indeed incorrect?

The documentation is, indeed, NOT correct. :-(

The correct list of short and full names is:
C - countryName
L - localityName
ST - stateOrProvinceName
O - organizationName
OU - organizationalUnitName
CN - commonName
emailAddress (no short name)

These are just looked up in openssl by using OBJ_txt2nid and I don't
really know if anything's changed in openssl or if this is just a
general fuckup by me, but these seven work with openssl 0.9.7.

> > There are, of course, properties of the certificate itself that you
> > could check, like whether it has expired and so forth.
> 
> Could you point me to some code examples?

Well, there's cert.has_expired(), cert.gmtime_adj_not{Before,After}
and stuff, but I don't have any example snippets as such.

> Related to this: how do I load a revoke list (CRL) in the Python
> interface?  I tried to load a CRL file with load_verify_locations(),
> which does not seem to produce an error, but also doesn't refuse the
> revoked certificates afterwards.

To be honest with you, I don't know, I haven't worked with CRLs (which
means it's a good bet it doesn't work at all in pyopenssl... patches
welcome :)


/Martin